Σχετ: Σχετ: Σχετ: Trusted Networks and scoring

2012-03-10 Thread Peter Tselios
I will check next Monday morning, but my feeling is that the @local_domains_acl is not set. But according to what is in the NOTE, it is implied that the headers are added to incoming emails only.  This it not what I want... P.

Re: Σχετ: Trusted Networks and scoring

2012-03-10 Thread Jari Fredriksson
9.3.2012 18:59, Peter Tselios kirjoitti: Setup is: Stock Postfix of CentOS 6, Amavisd-new, SpamAssassin 3.3.1 Network Flow is: (Incoming) Internet--Antispam/Relay Server--Antivirus Server--Mailbox Outgoing: Webmail--Antivirus--Antispam--Internet Actually, the problem is more intense I

Re: Better phish detection

2012-03-10 Thread hamann . w
Hello, We are getting a fair amount of very targetted phish attempts to our userbase. Since we are relatively small, I don't think any of the URIBLs really help (or phishtank or other lists) since we're not a large bank or paypal or anything like that. I did see some gentleman make

Re: Better phish detection

2012-03-10 Thread sporkman
hamann.w wrote: Hello, We are getting a fair amount of very targetted phish attempts to our userbase. Since we are relatively small, I don't think any of the URIBLs really help (or phishtank or other lists) since we're not a large bank or paypal or anything like that. I did

Re: Better phish detection

2012-03-10 Thread Dave Funk
On Sat, 10 Mar 2012, haman...@t-online.de wrote: Hello, We are getting a fair amount of very targetted phish attempts to our userbase. Since we are relatively small, I don't think any of the URIBLs really help (or phishtank or other lists) since we're not a large bank or paypal or anything

Re: Better phish detection

2012-03-10 Thread hamann . w
Hi, the replica seems to be down Things that could be promising: a) the form target seems to be similar to your site name b) it is probably possible to detect similarity between your image and the replica I guess that the presence of upgrade or webmail and a form url with bway inside

Re: Better phish detection

2012-03-10 Thread Ned Slider
On 10/03/12 20:27, sporkman wrote: Generally it is easier to offer suggestions if examples are provided (on pastebin) Here's the latest example: http://broomesol.com/upgrade.webmail.bway.net/main_login.htm Compare to our actual webmail login: https://webmail.bway.net/ This one is

Automatic rule generation Re: Better phish detection

2012-03-10 Thread darxus
The software used to generate the sought rules, or perhaps an old version of it, is in the spamassassin source tree. You can feed it a folder of known non-spams, and a folder of known spams, and it'll auto-generate rules that hit the spams but not the non-spams. Ah, I documented it some here: